CVSS Score: 10.0! WTF! CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:U/RC:C/CR:H/IR:H/AR:H I have literally taken over this whole banking system. I hold them in the palm of my hands. It feels good to be whitehat. #bugbounty #securityreseaech Dear project, make it worth it. I'm the new CEO.

Our recent works @Zer0day_sec keep re-hammering a cold fact, the reality of which many projects are still trying to grapple with: THE DAYS OF SECURITY BY OBSCURITY ARE OVER! If we found it, malicious actors can find it, and could have already found it too. A dangerous thing about these "secrets" is that their exposure/impacts could be STEALTHY!! So, dear projects, even while you're still arguing bounty, JUST F*CKIN FIX IT ALREADY! @Hacker0x01 @immunefi @HackenProof

If you see very dangerous gambles many high-profile projects are taking, you'd be amazed. Thats why some exploits, info leakage, data exfils, how ever sophisticated they look from they outside, would never surprise me. They are trivial. A case study: One could get hacked anytime using a hardcoded secret that looked benign on the surface, the secret was just used for nothing meaningful. And in their program details, they shot themselves in the foot by classifying such weaknesses as OOS. What they obscured, or o they thought, was the fact that same data combined with some other data were called at runtime for critical cryptographic calls. We saw this, yet, they claim its OOS. Tracing that call required either advanced tooling or insider info. As we speak, secret is still live. Not rotated. This is disappointing.